- openstack-discuss - lists.openstack.org

[Openstack] [Ocata] config option show_multiple_locations
by Eugen Block 29 Nov '18

29 Nov '18

Hello list, I have a strange issue I'd like to report here, I'm not sure whether this could be a bug or a config issue on my side. The environment has developed from Liberty to Ocata over the last 3 years, backend for glance, cinder and nova is Ceph since Mitaka release. So according to [1] these two config options should be set to true. > show_multiple_locations = True > show_image_direct_url = True This setup has worked just fine, live snapshots of nova worked as expected. Last year the environment was upgraded to Ocata (successfully), and some time later I decided to clean up the configs, I set show_multiple_locations to false, also because glance reports: > Option "show_multiple_locations" from group "DEFAULT" is deprecated > for removal. Its value may be silently ignored in the future. Since this change the nova live snapshots stopped working, resulting in this stack trace: ---cut here--- [req-5bd2fef2-2155-4a89-b346-e20fb0b0d14a df7b63e69da3b1ee2be3d79342e7992f3620beddbdac7768dcb738105e74301e 2e3c3f3822124a3fa9fd905164f519ae - - -] Failed to snapshot image Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/nova/virt/libvirt/driver.py", line 1626, in snapshot purge_props=False) File "/usr/lib/python2.7/site-packages/nova/image/api.py", line 132, in update purge_props=purge_props) File "/usr/lib/python2.7/site-packages/nova/image/glance.py", line 733, in update _reraise_translated_image_exception(image_id) File "/usr/lib/python2.7/site-packages/nova/image/glance.py", line 1050, in _reraise_translated_image_exception six.reraise(type(new_exc), new_exc, exc_trace) File "/usr/lib/python2.7/site-packages/nova/image/glance.py", line 731, in update image = self._update_v2(context, sent_service_image_meta, data) File "/usr/lib/python2.7/site-packages/nova/image/glance.py", line 745, in _update_v2 image = self._add_location(context, image_id, location) File "/usr/lib/python2.7/site-packages/nova/image/glance.py", line 630, in _add_location location, {}) File "/usr/lib/python2.7/site-packages/nova/image/glance.py", line 168, in call result = getattr(controller, method)(*args, **kwargs) File "/usr/lib/python2.7/site-packages/glanceclient/v2/images.py", line 340, in add_location response = self._send_image_update_request(image_id, add_patch) File "/usr/lib/python2.7/site-packages/glanceclient/common/utils.py", line 535, in inner return RequestIdProxy(wrapped(*args, **kwargs)) File "/usr/lib/python2.7/site-packages/glanceclient/v2/images.py", line 324, in _send_image_update_request data=json.dumps(patch_body)) File "/usr/lib/python2.7/site-packages/glanceclient/common/http.py", line 294, in patch return self._request('PATCH', url, **kwargs) File "/usr/lib/python2.7/site-packages/glanceclient/common/http.py", line 277, in _request resp, body_iter = self._handle_response(resp) File "/usr/lib/python2.7/site-packages/glanceclient/common/http.py", line 107, in _handle_response raise exc.from_response(resp, resp.content) ImageNotAuthorized: Not authorized for image e99b2dfd-db33-4475-a51f-af4b913a7041. INFO nova.compute.manager [req-5bd2fef2-2155-4a89-b346-e20fb0b0d14a df7b63e69da3b1ee2be3d79342e7992f3620beddbdac7768dcb738105e74301e 2e3c3f3822124a3fa9fd905164f519ae - - -] [instance: 751b3731-de0d-42cd-a105-b92e326294aa] Successfully reverted task state from image_uploading on failure for instance. ---cut here--- A couple of weeks passed until this problem occured (oviously nobody took snapshots), so I didn't immediately connect it to the config change, but when I followed the stack trace, I found this comment: ---cut here--- def _add_location(self, context, image_id, location): # 'show_multiple_locations' must be enabled in glance api conf file. [...] ---cut here--- I wouldn't expect this dependency if the option is marked as deprecated. Is this my misunderstanding or did I forget other configs that would prevent this behavior? Thank you for any information about this topic. Regards, Eugen [1] http://docs.ceph.com/docs/master/rbd/rbd-openstack/#for-mitaka-only

2 2

[openstack-dev] [mistral] Renat is on vacation until Dec 17th
by Renat Akhmerov 29 Nov '18

29 Nov '18

Hi, I’ll be on vacation till Dec 17th. I’ll be replying emails but with delays. Thanks Renat Akhmerov @Nokia __________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev

1 0

[Openstack] TAPaaS on Queens?
by M. Ranganathan 28 Nov '18

28 Nov '18

Hello all, I want to experiment with SNORT as a service on OpenStack. I looked at the TAPaaS project. However, I am not sure it runs on OpenStack Queens. I don't see it in the queens release https://releases.openstack.org/queens/index.html so I am wondering if this project is still alive (?) Thanks, Ranga -- M. Ranganathan _______________________________________________ Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack Post to : openstack(a)lists.openstack.org Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack

2 1

[glance] Interoperable Image Import: Plugin configuration ignored
by Bernd Bausch 28 Nov '18

28 Nov '18

Exploring image import on Rocky. My cloud is a Devstack. To permit image import, I modified it so that it runs Glance not as uwsgi processes behind Apache, but as standalone processes. The glance-direct image import process (create, stage, import) works - except that the configured plugin is simply ignored. /etc/glance/glance-image-import.conf: [image_import_opts] image_import_plugins = [inject_image_metadata] [inject_metadata_properties] inject = "import-type":"user-import" ignore_user_roles = admin /etc/glance/policy.json contains: "get_task": "", "get_tasks": "", "add_task": "", "modify_task": "", "tasks_api_access": "role:admin", Yet imported images are lacking the configured metadata. I added a few LOG calls. get_import_plugins() in glance/async/flows/plugins/__init__.py tells me that image_import_plugins = []. It looks like the configuration in glance-image-import.conf is ignored or not read at all. How can I find out what I am doing wrong?

1 0

[Openstack] How to create a tap port using openstack API?
by M. Ranganathan 28 Nov '18

28 Nov '18

Hello, I want to write my own VNF. For this I need to : 1. Create a network namespace. 2. Create a ovs internal port on a bridge with an appropriate tag. 3. Send the port to the network namespace. 4. Run a service in the network namespace that could (for example) read packets. Are there "openstack networking" commands to do steps 1-3 above or should this be done manually? ( What I want to do, essentially is to create a tap port and read packets from this tap port. Incidentally, the TAPaaS project was doing something like this but it seems to be unsupported.) Thanks, Ranga -- M. Ranganathan _______________________________________________ Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack Post to : openstack(a)lists.openstack.org Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack

1 0

[Openstack] OpenStack federation and WAYF process with multiple IdPs
by Rafael Weingärtner 28 Nov '18

28 Nov '18

Hello Openstackers, I am testing the integration of OpenStack (acting as a service provider) using Keycloak (as an identity provider) with OpenId Connect protocol. So far everything is working, but when I enable more than one IdP, I get an odd behavior. The “where are you from (WAYF)” process is happening twice, one in Horizon (where the user selects the authentication provider A.K.A IdP), and another one in Keystone via the Apache HTTPD OIDC module. I assume this is happening because the actual application being authenticated via OIDC is Keystone, and just afterwards, the other systems will authenticate themselves via Keystone. Has anybody else experienced/”dealt with” this situation? Is this by design? Am I missing a parameter/configuration or something else? The version of OpenStack that I am using is Rocky. -- Rafael Weingärtner _______________________________________________ Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack Post to : openstack(a)lists.openstack.org Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack

1 0

[nova] Heads up on default policy change for zero-disk flavors
by Matt Riedemann 28 Nov '18

28 Nov '18

Coming back to a security bug there is a change in nova [1] in Stein to change the value on the "os_compute_api:servers:create:zero_disk_flavor" policy rule to make it admin-only by default. This makes server create fail for non-admins users who are using flavors with root_gb=0 *unless* they are booting from volume. If you already have this configuration set before upgrading to stein then your deployment tooling shouldn't overwrite the configured policy and you won't notice any changes, but if you have an empty policy file and upgrade and have 0 root_gb flavors, your users could see server create failures. Let us know if you have any issues with this, or would like to see something done in the way of further documentation/communication and/or a nova-status upgrade check. [1] https://review.openstack.org/#/c/603910/ -- Thanks, Matt

1 0

[nova][cinder] Why can't nova in stein work with cinder from queens?
by Matt Riedemann 28 Nov '18

28 Nov '18

A change in nova [1] was approved which makes an assertion that we (nova? openstack?) do not support running nova from stein with cinder from queens, and I guess I'd like to know where that support statement is written down? Granted, I know we don't gate that way but I'm not aware of anything preventing it from working given we use microversions and nova, as the client, should be able to work with cinder from v1, v2 or v3 assuming it's doing version discovery correctly (which we've been doing in nova since queens when we needed to start using the cinder v3.44 volume attachments API for multiattach - but it's not required). In fact, nova-api still has compatibility code for older versions of cinder to determine what it should do about working with volume attachments [2]. I've been thinking lately about how to drop that code which would at the very least require a release note saying nova requires cinder >= queens, but nothing like that was requested in the change that drops support for cinder v1 from nova and asserts that nova in stein requires cinder >= queens. Maybe I'm just yelling at kids to get off my lawn, but I don't really want this to be precedent without some discussion because I know at various times operators have complained about upgrades being hard because they assume all of the services must be upgraded to the same release at the same time, and I don't think that is true, or should be true, because if it is, we're doing a really bad job of defining versioned interfaces between the services. [1] https://review.openstack.org/#/c/617927/ [2] https://github.com/openstack/nova/blob/7217e38bafb75e8a613763835b64e48e6b2c… -- Thanks, Matt

2 3

[OCTAVIA] How to monitor amphora
by Gaël THEROND 28 Nov '18

28 Nov '18

Hi guys, As already discussed I had to test Octavia as our corporate LoadBalancer solution and it was a success. Thank to everyone on this list that assisted me and especially Michael Octavia is fully working and without weird nightmare glitches. Now that I validated the technical part of my project, I need to enter more operationals questions such as what’s the best way to monitor and log amphora? I would like to be able to get a monitoring and logging agent installed on the amphora in order to get proper metrics about what’s going on with the LoadBalancer, is it fully cpu loaded? Is it using all network resources available, are the file descriptors near the initial limits? How much xxx HTTP return code the loadBalancer is facing and send those logs to an ELK or something similar. Do you know if that something that I could achieve by adding more elements to the image at DIB time or are there any other better best-practices that I should be aware of ? As Octavia is creating a namespace for each HAProxy process, I am wandering if it’s even possible. Thanks a lot for your hard work guys. Kind regards,

5 8

[loci] Project Technical Leadership Change
by Chris Hoge 28 Nov '18

28 Nov '18

After discussion with the current Loci PTL, team members, and the OpenStack TC at the Berlin Summit, I will be stepping in as interim PTL for the Loci project for the remainder of the development cycle. If you have any questions or concerns about this, please feel free to reach out to me directly. As a reminder, Loci has weekly team meetings on Friday at 1500 UTC in the #openstack-loci channel that we will be resuming this week. Thanks, Chris Hoge

2 3